A “Do Not Track List” for Canada? Written By: Janet Lo Public Interest Advocacy Centre 1204 - ONE Nicholas St. Ottawa, Ontario K1N 7B7 October 2009 With Funding from Industry Canada Copyright 2009 PIAC Contents may not be commercially reproduced. Any other reproduction with acknowledgment is encouraged. The Public Interest Advocacy Centre (PIAC) Suite 1204 ONE Nicholas Street Ottawa, ON K1N 7B7 Tel: (613) 562-4002 Fax: (613) 562-0007 E-mail: [email protected] Website: www.piac.ca Canadian Cataloguing and Publication Data Lo, Janet A “Do Not Track List” for Canada? 1-895060-92-3 2 Acknowledgement Financial support from Industry Canada to conduct the research on which this report is based is gratefully acknowledged. The views expressed in this report are not necessarily those of Industry Canada or of the Government of Canada. Additional research for this report was provided by Michelle Kelly & Kathryn Bortolussi. The author would also like to thank John Lawford for his support and guidance in the writing of this report. 3 EXECUTIVE SUMMARY This report examines online behavioral targeted advertising and online behavioral tracking, the practice of tracking consumers’ online activities to target advertising to individual consumers based on their online history, preferences and attributes. Marketers and businesses suggest that targeted advertising would benefit consumers in the form of more relevant advertisements and offers tailored to their interests and needs. Consumer advocates have voiced several concerns with the practice of online tracking, from privacy invasion and data collection practices to concerns with discriminatory advertisements and the potential to target vulnerable consumers. However, it has been difficult for consumers to voice their concerns with behavioural targeted advertising practices, as industry practices have often been conducted covertly with little or vague notice to consumers hidden in privacy policies or terms of use. As online behavioural targeted advertising becomes the ubiquitous industry standard, consumers are at the mercy of online advertisers with few options to control how their personal information is collected, used, disclosed and retained. This report is informed by a survey designed by PIAC and conducted by Environics which examines consumer awareness and attitudes towards online tracking and behavioural advertising, with specific questions about a potential “Do Not Track List” in Canada. This paper concludes that consumers are not aware of consumer surveillance on the internet and technical tools used by companies to track their behaviour online. Futhermore, consumers are not aware of the extent to which their personal information is collected and used to serve behaviourally targeted advertising to appeal to their consumer profile. Consumers want the ability to control their personal information online – not only when and how it is collected, but also how it is used and shared with other parties. Consumer consent is only meaningful when proper notice is present, thus transparency in online behavioural targeted advertising practices is very important. In order to obtain informed consent to their practices, websites must clearly and openly notify their users of the tracking tools used by their websites and affiliates to track their behaviours online. Consumer education through proper notice is only part of the solution. At the moment, there is a great power imbalance between the online advertising industry and consumers, as online behavioural targeted marketing has become the norm and industry standard without any oversight by regulatory bodies. These practices have evolved without proper consideration to protect consumer autonomy and privacy and only with the goal of advertising revenues in mind. Canadian consumers surveyed by PIAC expressed discomfort with online tracking for the purpose of targeted and behavioural advertising. The majority of survey respondents supported the creation of a “Do Not Track List,” which would be a service 4 wherein consumers who sign up for the list would not have information about their online activities collected, used or disclosed. However, it would be very difficult to design and deploy a “Do Not Track List” without assigning users a unique identifier. Furthermore, efforts to establish a “Do Not Track List” would face opposition and lobbying by industry to create loopholes and exceptions for businesses. Implementing a “Do Not Track List” in Canada would give Canadian consumers better control over their personal information while they surf the internet. However, while a “Do Not Track List” would certainly be a step to better protection for consumers from online tracking, it cannot be expected to provide holistic or foolproof consumer protection, especially given the logistical and technical barriers to effective implementation. The report makes several recommendations, including a requirement for consumer opt- in consent to online tracking and behavioural targeted advertising. Greater transparency and consumer education are needed for tracking technologies and behavioural targeted advertising practices on the internet. Canadian legislators and regulators should begin studying the issue of online behavioural targeted advertising to catch up to American and European regulators, who have already begun considering how their regulatory frameworks protect their consumers on the internet. The Privacy Commissioner should review the existing Personal Information Protection and Electronic Documents Act to set out guidelines for how website operators can deploy behavioural advertisement technology in order to comply with the law and protect the privacy of Canadians. The Government should review existing privacy legislation and regulatory framework and bring forward new rules as necessary to ensure that these systems only operate on an explicit, informed, opt-in basis and that an effective enforcement mechanism with fines exists to punish marketers who operate outside the rules. Special consideration must also be given to the issue of behavioural advertising targeting children and young people. While a “Do Not Track List” would likely encounter considerable industry objection and operational and technical barriers, regulators are in a position to set down clear guidelines for online behavioural targeted advertising practices. Given the prevalence of personal information collection, use and disclosure for the purposes of behavioural targeted advertising on the internet, only clear, enforceable rules can make a significant impact to protect consumers from unwanted online surveillance and behavioural targeted advertisements. The extent of online behavioural targeted advertising and consumer tracking on the internet is troubling, and better privacy and data protection must be afforded to consumers while they conduct everyday activities on the internet. 5 Detailed Table of Contents Acknowledgement ........................................................................................................... 3 EXECUTIVE SUMMARY ................................................................................................. 4 INTRODUCTION ............................................................................................................. 8 PART 1: CONSUMER ATTITUDES TO ONLINE TARGETED ADVERTISING AND ONLINE TRACKING ..................................................................................................... 10 1.1. PIAC’s survey of consumer attitudes ................................................................. 10 1.1.1. Research methodology ............................................................................... 10 1.1.2. Key findings ................................................................................................. 10 1.1.3. Survey limitations ........................................................................................ 12 1.2. American surveys of consumer attitudes to online tracking ............................... 13 1.2.1. TRUSTe surveys ......................................................................................... 13 1.2.2. Americans reject tailored advertising .......................................................... 14 1.2.3. Other American surveys on collection of personal information and profiling 14 PART 2: FROM TRADITIONAL ADVERTISING TO ONLINE TARGETED ADVERTISING .............................................................................................................. 17 PART 3: ONLINE BEHAVIORAL TARGETED ADVERTISING & TRACKING: HOW IT WORKS ......................................................................................................................... 20 3.1. Cookies .............................................................................................................. 21 3.2. Search advertising and online behavioural advertising: Microsoft-Yahoo and Google ....................................................................................................................... 24 3.2.1. Microsoft and Yahoo’s Search Advertising and Behavioural Targeting Practices ................................................................................................................ 25 3.2.2. Google search and advertising programs ................................................... 28 3.2.2.1. Google’s acquisition of DoubleClick prompts concerns by privacy and consumer advocates .......................................................................................... 28 3.2.2.2. Google’s